spravki-dispansers[.]info

This domain, spravki-dispansers.info, is flagged for hosting a generic phishing campaign specializing in the fraudulent sale of medical documents. Analysis indicates the threat type involves fake medical certificates and dispensary records, targeting individuals seeking counterfeit health documentation. The elevated risk level stems from potential financial fraud, identity theft, and legal consequences for victims unknowingly using falsified documents for employment, insurance, or travel purposes. Infrastructure analysis reveals the domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited, a registrar frequently associated with high-risk domains. The site resolves to IP address 5.187.1.239 and is currently offline, though it remains listed on one security blocklist. Detection metrics show 3 out of 95 security vendors on VirusTotal flagged the domain as malicious, while Gridinsoft assigned a trust score of 0/100. The site employed WordPress with MySQL and PHP backend technologies, alongside tracking tools such as Yandex.Metrika and jQuery Migrate. A Let's Encrypt SSL certificate was used to create a false sense of legitimacy. Mitigation steps for this specific threat type include verifying the authenticity of medical documents through official healthcare providers or government portals. Organizations should implement email and web filtering rules to block domains registered through high-risk registrars like NiceNIC. End users are advised to scrutinize domains offering medical services or documents for sale, particularly those with recent creation dates or low detection counts on security platforms. Network administrators should monitor and block traffic to the identified IP address 5.187.1.239 to prevent potential data exfiltration or credential harvesting attempts linked to this campaign.